ci.yml

name: CI

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      backends: ${{ steps.set.outputs.backends }}
      backends_testable: ${{ steps.set.outputs.backends_testable }}
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@v5

      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4
        id: filter
        with:
          filters: |
            auth: 'apps/Auth/**'
            attendance: 'apps/Attendance/**'
            coursemanagement: 'apps/CourseManagement/**'
            payment: 'apps/Payment/**'
            credentials: 'apps/Credentials/**'
            frontend: 'apps/Frontend/**'

      - id: set
        run: |
          set -euo pipefail
          declare -A flags=(
            [Auth]='${{ steps.filter.outputs.auth }}'
            [Attendance]='${{ steps.filter.outputs.attendance }}'
            [CourseManagement]='${{ steps.filter.outputs.coursemanagement }}'
            [Payment]='${{ steps.filter.outputs.payment }}'
            [Credentials]='${{ steps.filter.outputs.credentials }}'
          )
          backends=()
          testable=()
          for svc in Auth Attendance CourseManagement Payment Credentials; do
            if [ "${flags[$svc]}" = "true" ]; then
              backends+=("$svc")
              if [ "$svc" != "Credentials" ]; then
                testable+=("$svc")
              fi
            fi
          done
          emit() {
            local name="$1"; shift
            if [ "$#" -eq 0 ]; then
              echo "$name=[]" >> "$GITHUB_OUTPUT"
            else
              echo "$name=$(printf '%s\n' "$@" | jq -R . | jq -cs .)" >> "$GITHUB_OUTPUT"
            fi
          }
          emit backends "${backends[@]}"
          emit backends_testable "${testable[@]}"

  lint-dockerfiles:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Lint Dockerfiles
        run: |
          for dockerfile in \
            infrastructure/environments/auth/Dockerfile \
            infrastructure/environments/attendance/Dockerfile \
            infrastructure/environments/course-management/Dockerfile \
            infrastructure/environments/payment/Dockerfile \
            infrastructure/environments/credentials/Dockerfile \
            infrastructure/environments/api-gateway/Dockerfile \
            infrastructure/environments/frontend/Dockerfile \
            infrastructure/environments/rabbitmq/Dockerfile \
            infrastructure/environments/tls-init/Dockerfile; do
            echo "Linting $dockerfile"
            docker run --rm -i hadolint/hadolint@sha256:30a8fd2e785ab6176eed53f74769e04f125afb2f74a6c52aef7d463583b6d45e < "$dockerfile"
          done

  build-backend:
    needs: changes
    if: ${{ needs.changes.outputs.backends != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        service: ${{ fromJSON(needs.changes.outputs.backends) }}
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '9.0.x'

      - uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ matrix.service }}-${{ hashFiles(format('apps/{0}/Backend/Backend.csproj', matrix.service)) }}
          restore-keys: |
            nuget-${{ runner.os }}-${{ matrix.service }}-
            nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore apps/${{ matrix.service }}/Backend/Backend.csproj --locked-mode

      - name: Verify formatting (.editorconfig + analyzers)
        run: dotnet format apps/${{ matrix.service }}/Backend/Backend.csproj --verify-no-changes --no-restore

      - name: Build (warnings as errors → SonarAnalyzer strict)
        run: dotnet build apps/${{ matrix.service }}/Backend/Backend.csproj -c Release --no-restore -p:TreatWarningsAsErrors=true

      - name: Generate SBOM
        run: |
          dotnet tool install --global Microsoft.Sbom.DotNet
          export PATH="$HOME/.dotnet/tools:$PATH"
          sbom-tool generate \
            -b apps/${{ matrix.service }}/Backend \
            -bc apps/${{ matrix.service }}/Backend \
            -pn DAMA.${{ matrix.service }} \
            -pv ${{ github.sha }} \
            -ps DAMA-Software \
            -nsb https://github.com/JCarlosHidalgo/DAMA
        continue-on-error: true

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: sbom-${{ matrix.service }}
          path: apps/${{ matrix.service }}/Backend/_manifest/spdx_2.2/

  build-frontend:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/Frontend
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: '1.3.10'

      - uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('apps/Frontend/bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-

      - name: Install
        run: bun install --frozen-lockfile

      - name: Prettier check
        run: bun run format:check

      - name: ESLint
        run: bun run lint

      - name: Build
        run: bun run build

  test-backend:
    needs: [changes, build-backend]
    if: ${{ needs.changes.outputs.backends_testable != '[]' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        service: ${{ fromJSON(needs.changes.outputs.backends_testable) }}
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '9.0.x'

      - uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ matrix.service }}-${{ hashFiles(format('apps/{0}/Backend/Backend.csproj', matrix.service), format('apps/{0}/Test/Test.csproj', matrix.service)) }}
          restore-keys: |
            nuget-${{ runner.os }}-${{ matrix.service }}-
            nuget-${{ runner.os }}-

      - name: Restore test project
        run: dotnet restore apps/${{ matrix.service }}/Test/Test.csproj

      - name: Test
        run: >
          dotnet test apps/${{ matrix.service }}/Test/Test.csproj
          --no-restore
          --settings apps/${{ matrix.service }}/Test/.runsettings
          --logger "trx;LogFileName=test-results.trx"
          --results-directory apps/${{ matrix.service }}/Test/TestResults

      - name: Critical coverage gate (100% business-logic lines)
        run: python3 infrastructure/environments-test/cobertura-backends/check-coverage.py "${{ matrix.service }}" "apps/${{ matrix.service }}/Test/TestResults"

      - name: Test summary
        if: ${{ always() }}
        env:
          SERVICE: ${{ matrix.service }}
        run: |
          set -euo pipefail
          trx=$(find "apps/${SERVICE}/Test/TestResults" -name '*.trx' | head -n1 || true)
          if [ -z "$trx" ]; then
            {
              echo "## ${SERVICE} Backend Test Report"
              echo ""
              echo "_No test results (.trx) were produced._"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          python3 - "$trx" >> "$GITHUB_STEP_SUMMARY" <<'PY'
          import os, sys, xml.etree.ElementTree as ET

          service = os.environ["SERVICE"]
          root = ET.parse(sys.argv[1]).getroot()
          local = lambda tag: tag.split('}')[-1]

          counters = {}
          classes = set()
          for element in root.iter():
              name = local(element.tag)
              if name == "Counters":
                  counters = element.attrib
              elif name == "TestMethod":
                  class_name = element.attrib.get("className")
                  if class_name:
                      classes.add(class_name)

          total = int(counters.get("total", 0))
          passed = int(counters.get("passed", 0))
          failed = int(counters.get("failed", 0))
          executed = int(counters.get("executed", 0))
          skipped = max(total - executed, 0)

          separator = " · "
          plural = lambda count, one, many: one if count == 1 else many

          primary = []
          if failed > 0:
              primary.append(f"❌ **{failed} {plural(failed, 'failure', 'failures')}**")
          if passed > 0:
              primary.append(f"✅ **{passed} {plural(passed, 'pass', 'passes')}**")
          primary.append(f"{total} total")

          lines = [
              f"## {service} Backend Test Report",
              "",
              "### Summary",
              "",
              f"- **Test Files**: {len(classes)} total",
              f"- **Test Results**: {separator.join(primary)}",
          ]
          if skipped > 0:
              lines.append(f"- **Other**: {skipped} skipped{separator}{skipped} total")
          print("\n".join(lines))
          PY

  test-frontend:
    needs: [changes, build-frontend]
    if: ${{ needs.changes.outputs.frontend == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/Frontend
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: '1.3.10'

      - uses: actions/cache@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ runner.os }}-${{ hashFiles('apps/Frontend/bun.lock') }}
          restore-keys: |
            bun-${{ runner.os }}-

      - name: Install
        run: bun install --frozen-lockfile

      - name: Test (with coverage gate)
        run: bun run test:coverage:gate

  ci-gate:
    needs: [build-backend, build-frontend, test-backend, test-frontend, lint-dockerfiles]
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Verify required jobs succeeded
        run: |
          set -euo pipefail
          declare -A results=(
            [build-backend]='${{ needs.build-backend.result }}'
            [build-frontend]='${{ needs.build-frontend.result }}'
            [test-backend]='${{ needs.test-backend.result }}'
            [test-frontend]='${{ needs.test-frontend.result }}'
            [lint-dockerfiles]='${{ needs.lint-dockerfiles.result }}'
          )
          failed=0
          for job in "${!results[@]}"; do
            result="${results[$job]}"
            echo "$job: $result"
            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
              failed=1
            fi
          done
          if [ "$failed" -ne 0 ]; then
            echo "One or more required jobs did not succeed."
            exit 1
          fi